https://www.vulnerabilityoperationcenter.org/en/blog Latest from Blog en Thu, 05 Nov 2026 20:49:15 GMT https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-management-tooling-landscape https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-management-tooling-landscape A vendor-neutral map of VOC tool categories — inventory, scanners, cloud, containers, SCA, EASM, aggregation, ticketing — and how to choose and connect them. Florian Amette Fri, 25 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/communicating-vulnerability-risk-to-leadership https://www.vulnerabilityoperationcenter.org/en/blog/communicating-vulnerability-risk-to-leadership How a VOC reports to executives and the board: audiences, a one-page structure, KRIs vs KPIs, trends over snapshots, and what to leave out. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-management-metrics https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-management-metrics Define and compute the metrics a VOC needs: time to remediate with percentiles, SLA compliance, coverage, backlog age, KEV exposure windows and reopen rate. Florian Amette Wed, 23 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-exceptions-and-risk-acceptance https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-exceptions-and-risk-acceptance Run a vulnerability exception process that stays honest: exception types, approval by risk level, compensating controls, expiry and an auditable register. Florian Amette Mon, 21 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/remediation-workflow-and-ticketing https://www.vulnerabilityoperationcenter.org/en/blog/remediation-workflow-and-ticketing An end-to-end remediation workflow: deduplicate findings, group them by fix, route to owners, integrate with ITSM, and close only on rescan evidence. Florian Amette Fri, 18 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/remediation-slas https://www.vulnerabilityoperationcenter.org/en/blog/remediation-slas Design risk-based vulnerability remediation SLAs: tiers instead of raw CVSS, when the clock starts and pauses, escalation, and measuring compliance. Florian Amette Wed, 16 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/ssvc-vulnerability-decision-trees https://www.vulnerabilityoperationcenter.org/en/blog/ssvc-vulnerability-decision-trees How Stakeholder-Specific Vulnerability Categorization (SSVC) works, how to evaluate each decision point, and how to map Track, Attend and Act to SLAs. Florian Amette Mon, 14 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/risk-based-prioritization-cvss-epss-kev https://www.vulnerabilityoperationcenter.org/en/blog/risk-based-prioritization-cvss-epss-kev How to combine CVSS v4 severity, EPSS exploitation probability, the CISA KEV catalog and asset context into priority tiers teams can meet. Florian Amette Fri, 11 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-scanning-strategy https://www.vulnerabilityoperationcenter.org/en/blog/vulnerability-scanning-strategy Design a scanning strategy for a VOC: authenticated scans, agents, cloud and container assessment, SCA, DAST, safe scanning and measurable coverage. Florian Amette Wed, 09 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/asset-inventory-for-vulnerability-management https://www.vulnerabilityoperationcenter.org/en/blog/asset-inventory-for-vulnerability-management Build an asset inventory a VOC can rely on: data sources, reconciliation keys, ownership and criticality attributes, and measuring coverage gaps. Florian Amette Mon, 07 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/voc-roles-and-responsibilities https://www.vulnerabilityoperationcenter.org/en/blog/voc-roles-and-responsibilities Who does what in a Vulnerability Operations Center: core roles, a full RACI across the lifecycle, and how the VOC works with the SOC, IT and developers. Florian Amette Fri, 04 Sep 2026 00:00:00 GMT https://www.vulnerabilityoperationcenter.org/en/blog/building-a-vulnerability-operations-center https://www.vulnerabilityoperationcenter.org/en/blog/building-a-vulnerability-operations-center What a Vulnerability Operations Center is, how it differs from a SOC or a scanning team, and how to charter, staff and run one step by step. Florian Amette Wed, 02 Sep 2026 00:00:00 GMT